ClawHub

一个智能的业务需求转研发文档工具。AI 自主分析项目代码库，理解业务需求，参考实际代码，生成可直接执行的研发文档。支持任意技术栈，无需配置。

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is purpose-aligned, but it will read a scoped project and save a local project summary file.

Install only if you are comfortable with the agent reading the project path you provide and writing `.ai-memory/project-profile.md` inside it. Review that file for sensitive architecture or business details, add `.ai-memory/` to `.gitignore` if needed, and delete or refresh it when sharing the repo or after major code changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The example shows the agent automatically persisting project analysis to `~/projects/skye-oms/.ai-memory/project-profile.md` without any explicit consent, warning, or discussion of retention. In a skill that inspects real codebases, automatic writes can create privacy, compliance, and integrity risks by storing sensitive architectural details or business context on disk unexpectedly.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The README explicitly states that the tool persists a derived project profile to `.ai-memory/project-profile.md`, but does not warn users that repository-derived metadata may contain sensitive architectural details, internal paths, naming conventions, or business logic summaries. In a tool that autonomously explores arbitrary codebases, silent persistence increases the risk of unintended local retention of sensitive information and secondary exposure through commits, backups, or shared workspaces.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to persist project-analysis data into a hidden `.ai-memory/` directory inside the target repository without clearly warning the user that local files will be created and retained. This can unexpectedly store sensitive architectural details, business context, or code-derived metadata in the workspace, where it may be committed to version control, read by other tools, or left behind on shared systems.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal